Stopping Invoice Fraud: A Practical Guide for Small Business
· Rafael Cortes · 3 min read
Protect your business from the most common way small companies lose money: fraudulent payment requests.
For most small and medium businesses, the biggest digital threat isn't a complex Hollywood-style hack. It is something much simpler and more effective: Business Email Compromise. This is when a criminal gains access to an email account—either yours, your vendor’s, or your customer’s—and uses it to redirect a legitimate payment into their own bank account.
The Anatomy of a Payment Scam
Imagine you have been working with a regular supplier for years. You receive an email from your usual contact at that company. The email looks perfect; it’s part of your existing conversation thread. They inform you that they are changing their banking details and ask you to send all future payments to a new account. Because you trust them, you update the record and send the next $5,000 payment.
Two weeks later, the real supplier calls asking why their bill hasn't been paid. By then, your money is long gone, and the bank often cannot recover it. The "hack" wasn't against the bank; it was against the trust you had in an email message.
The "Second Channel" Rule
The most powerful tool you have to stop this is a simple internal policy. At Axionix, we recommend the Second Channel Rule. This rule states that you never update banking, payroll, or sensitive payment information based on an email alone. You must verify the change through a second, different communication channel.
If you get an email about a bank change, pick up the phone and call a known, trusted contact at that company using a number you already have on file (not the number in the suspicious email). A thirty-second phone call can save your business thousands of dollars.
Weekly Payment Safety Checklist
- Verify changes via phone: Always call a known contact to confirm any changes to payment instructions or bank accounts.
- Check the "Reply-To" address: Hover over the sender's name to ensure the actual email address matches their usual one exactly.
- Enable Multi-Factor Authentication (MFA): Ensure every employee with access to email and accounting tools uses MFA to prevent account takeovers.
- Flag external emails: Have your IT provider set up a banner that highlights emails coming from outside your organization.
- Review "Auto-Forwarding" rules: Check your email settings once a month to ensure no hidden rules are sending your emails to an ex ternal address.
Technology should make your business faster, not more vulnerable. By implementing these simple procedural guardrails, you can protect your cash flow without needing a massive security budget.
Axionix Systems can help. We provide security risk reviews and employee awareness guidance to help you lock down your payment processes and email systems. Contact us at axionixsystems.com.